6.
2. Uncontrolled format string
printf(a);
Risk level 4: If format strings can be influenced by an attacker,
they can be exploited. Use a constant for the format
specification.
printf(“%s”, a);
No level / Level 0: If format strings can be influenced by an
attacker, they can be exploited. Use a constant for the format
specification. Constant format string, so not considered very
risky (there’s some residual risk, especially in a loop).
6
Software Security, FCS Iasi, 2013

7.
3. Shell metacharacter dangers
CreateProcess(NULL, "C:Program
FilesGoodGuyGoodGuy.exe -x",
"");
Risk level 3: This causes a new process to execute and is
difficult to use safely. Specify the application path in the first
argument, NOT as part of the second, or embedded spaces
could allow an attacker to force a different program to run.
7
Software Security, FCS Iasi, 2013

11.
Comparison: ITS4
 Supports C and C++
 Written in C, uses just a C compiler
 Detects Buffer Overflows, Format String
Problems, Shell Executions, TOCTOU, Usage of
weak random number generation, User Input
 The output prints the filename, line-number and
the name of the found function and also a short
description of the issue and other suggestions.
11
Software Security, FCS Iasi, 2013